I'm OK with adding a doc change before 3.6.0 final. But since this behavior is not new with 3.6, I would rather save any code changes for 3.6.1 unless there is a consensus that this is an urgent security issue.